Exposed FOSSA API Key in github repository

### Description I have identified a security issue in the Volcano repository. [volcano/.github/workflows/fossa.yml at 4687fce2dc41d3e5f56d38f34db559fe9f725ff0 · volcano-sh/volcano](https://github.com/volcano-sh/volcano/blob/4687fce2dc41d3e5f56d38f34db559fe9f725ff0/.github/workflows/fossa.yml#L21) contains a hardcoded FOSSA API key at line 21: FOSSA_API_KEY: '1a92b8d8ee4304c0ad85a726b9e9acab' This key appears to be a push-only token. While it cannot query project data, it can still be used to push dependency scan results. Exposing any API key publicly poses a security risk, as it could be misused by unauthorized parties. Impact: Unauthorized use of the FOSSA API key. Potential manipulation of dependency scan results. Risk of account misuse or billing issues if the token remains active. ### Steps to reproduce the issue Steps to Reproduce:Navigate to the repository commit: 4687fce2dc41d3e5f56d38f34db559fe9f725ff0.Open .github/workflows/fossa.yml.At line 21, observe the hardcoded API key.Attempt to use the key with curl against FOSSA’s API results in a 403 Forbidden error, confirming it is a push-only token.Recommendations:Rotate the exposed key immediately in FOSSA to invalidate it.Store the new key in GitHub Secrets instead of committing it directly to the workflow file.Update the workflow to reference the secret securely:env: FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }}Audit the repository for other sensitive values that may have been committed. ### Describe the results you received and expected REQUESTING AN CVE ID ### What version of Volcano are you using? ALL ### Any other relevant information _No response_